At one
look
look
- 01. A definition of DORA
- 02. What problems does DORA address?
- 03. What are the objectives of DORA?
- 04. Which companies are affected by DORA?
- 05. What are the practical implications of DORA?
- 06. What are the core requirements of DORA for financial entities?
- 07. When do the new DORA regulations apply?
- 08. What do financial entities need to consider when choosing an ICT third party service provider in the future?
- 09. Myra is already fit for DORA
01
A definition of DORA
The proposed Digital Operational Resilience Act (DORA) is part of a package of measures to digitize the financial sector presented by the European Commission at the end of September 2020. The Commission aims for the package to promote Europe’s competitiveness and innovation in the financial sector.
The financial sector relies heavily on information and communication technology (ICT). The coronavirus pandemic has exacerbated this as customers are increasingly using digital services. This dependency on ICT makes financial entities particularly vulnerable to cyber attacks or incidents. Moreover, the consequences of an attack or disruption at an important cross-border financial service can have far-reaching effects on other companies, sub-sectors, or even the rest of the economy. That is why digital operational resilience in the financial sector is of enormous importance. With regard to industry investigations, the Commission estimates the cost of operational incidents in the EU financial sector to be up to €27 billion per year.
Improve cyber defense and oversight
In this context, DORA aims to ensure that all financial sector stakeholders have taken the necessary security measures to prevent or mitigate ICT-related cyber attacks and other incidents. Moreover, DORA is expected to enable European supervisory authorities to review outsourced services. To this end, a supervisory framework for third-party ICT providers operating in the financial sector, such as cloud computing service providers, will be introduced.
Core content
The EU regulation “on digital operational resilience for the financial sector” contains requirements relating to ICT risk management, the classification and reporting of ICT-related incidents, digital operational resilience tests, contractual agreements between ICT third-party service providers and financial entities, the supervisory framework for critical ICT third-party service providers, and rules for the exchange of information.
06
What are the core requirements of DORA for financial entities?
In principle, many of the requirements formulated in the DORA regulation, such as for ICT risk management, are already familiar from existing financial sector regulations such as the EBA Guidelines, MaRisk, or BAIT. In some cases, however, they also go beyond this, such as the monitoring and supervision of ICT service providers or the audit of ICT systems. The following points must be observed:
ICT risk management
Strong involvement of the management board:
It is responsible for all arrangements related to the ICT risk management framework and needs to review business continuity and disaster recovery plans, for instance.
Identification:
Companies must identify, classify, and document business functions and supporting information resources that are potential sources of ICT risk. This applies in particular to system areas that are networked with internal and external ICT systems.
Protection and prevention:
The functioning of ICT systems must be continuously overseen and monitored to ensure adequate protection. This requires the preventive implementation of appropriate security strategies, policies, procedures, and tools.
Detection of anomalous activities:
Companies must have mechanisms in place to detect anomalous activities immediately and identify any potential vulnerabilities.
Countermeasures and recovery:
Companies must set up response and recovery measures as well as develop appropriate business continuity and disaster recovery strategies and plans. Even companies that otherwise already meet many of DORA’s ICT risk management requirements should therefore consider whether their response and recovery strategies and plans also comply with the extended rules in these areas.
Communication:
Companies must develop a “responsible disclosure of ICT-related incidents or major vulnerabilities” to clients, other financial entities, and the public.
Reporting of ICT-related incidents
Management:
Financial entities must establish and apply a specific incident management process to identify, track, log, categorize, and classify ICT incidents.
Classification:
The classification of ICT incidents must be based on a number of criteria to be further developed by the Joint Committee of the ESAs.
Reporting:
Companies are required to report serious ICT incidents to the competent authority within prescribed deadlines and using harmonized report templates.
Digital operational resilience testing
General requirements:
As an integral part of the ICT risk management framework, DORA requires companies to adopt a robust and comprehensive digital operational resilience testing program covering ICT tools, systems, and processes.
Advanced testing:
Certain financial institutions must carry out advanced testing of their ICT tools, systems, and processes at least every three years using threat-led penetration tests. Affected companies should closely monitor how the ESAs establish the implementation criteria.
Management of ICT third-party risk
General principles:
Financial entities must manage the ICT third-party risk within their ICT risk management framework in accordance with certain principles. These include responsibility and liability, proportionality, a strategy for ICT third-party risk, documentation and record-keeping, pre-contractual analysis, information security, audits and inspections, termination rights, and exit strategies.
Preliminary assessment of ICT concentration risk and other sub-outsourcing arrangements:
The mandatory preliminary assessment aims to determine whether the conclusion of a contractual agreement in relation to the ICT services would lead to a contract with an ICT third-party service provider considered dominant, which is not easily replaceable. It should also show whether several contractual arrangements have been concluded with the same ICT third-party service provider or with closely connected service providers.
Key contractual provisions:
The rights and obligations of the financial entity and of the ICT third-party service provider must be clearly allocated and defined in a contractual agreement whose detailed scope is defined in legislation.
Information sharing arrangements
Information-sharing on cyber threats:
DORA enables financial entities to share among themselves cyber threat information and intelligence to strengthen digital operational resilience. This includes indicators of compromise, tactics, techniques, procedures, cybersecurity alerts, and configuration tools.
